Critical severity9.8NVD Advisory· Published Jul 31, 2025· Updated Apr 15, 2026

CVE-2025-50475

Description

An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands as root via crafted input to the hostname parameter in network configuration requests. This vulnerability stems from improper neutralization of special elements used in an OS command within the network configuration handler, enabling remote code execution with the highest privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Russound/MBX-PRE-D67Fllm-create
Range: =3.1.6

Patches

Vulnerability mechanics

References

drive.google.com/file/d/1ZmZHzJKU-nrhFXd9w94aiGXYYYldtmni/viewnvd
pastebin.com/ic8hkC5Vnvd
pastebin.com/raw/0U6F55G5nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000